Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Policy Machine: Features, Architecture, and Specification



David F. Ferraiolo, Serban I. Gavrila, Wayne Jansen


The ability to control access to sensitive data in accordance with policy is perhaps the most fundamental security requirement. Despite over four decades of security research, the limited ability for existing access control mechanisms to enforce a comprehensive range of policy persists. While researchers, practitioners and policy makers have specified a large variety of access control policies to address real-world security issues, only a relatively small subset of these policies can be enforced through off-the-shelf technology, and even a smaller subset can be enforced by any one mechanism. This report describes an access control framework, referred to as the Policy Machine (PM), which fundamentally changes the way policy is expressed and enforced. The report gives an overview of the PM and the range of policies that can be specified and enacted. The report also describes the architecture of the PM and the properties of the PM model in detail. [Supersedes NISTIR 7987 (May 2014): publication-search.cfm?pub_id=913195]
NIST Interagency/Internal Report (NISTIR) - 7987 Rev 1
Report Number
7987 Rev 1


access control, Attribute Based Access Control, access control policies, policy enforcement, privilege management, computer security


Ferraiolo, D. , Gavrila, S. and Jansen, W. (2015), Policy Machine: Features, Architecture, and Specification, NIST Interagency/Internal Report (NISTIR), National Institute of Standards and Technology, Gaithersburg, MD, [online], (Accessed May 20, 2024)


If you have any questions about this publication or are having problems accessing it, please contact

Created October 27, 2015, Updated November 10, 2018